Stay organized with collections
Save and categorize content based on your preferences.
Public network connectivity
This page describes how Integration Connectors can connect to your publicly accessible backend applications.
The following are the two ways to connect to your public backend application:
Connect to your public backend application directly.
Connect to your public backend application through a firewall.
Connect to your public backend application directly
If you can publicly connect to your backend application, you can
configure your connection to use the
public endpoint by specifying the endpoint in the Hostname
field. Your connections will have direct access to your backend application.
Connect to your public backend application through a firewall
In cases where you want to restrict access to your public
endpoints with a firewall, you can configure
Integration Connectors to use a set of static IP addresses for
the traffic originating from the connections. After the configuration, all calls from a connection would originate from a set of static IP address, which you can allowlist in your firewall. To allow a connection to connect through a firewall, you must do the following high-level steps:
Create a firewall, and route your egress traffic through the firewall.
Assign a static IP address to your connection.
Allowlist the assigned static IP address in your firewall.
Steps to create and configure a firewall are outside the scope of this page. This page only describes
how you can assign static IP addresses to your connections.
By default, Integration Connectors allocates IP addresses automatically. However, you can
configure Integration Connectors to generate static IP addresses instead of an automatic
IP addresses. Integration Connectors assigns the static IP addresses
at a region level. For example, the static IP addresses for the us-east1
region will be different from the static IP addresses in the us-west2 region.
To assign static IP addresses to your connection, do the following steps:
Get the region of the connection for which you want to allocate the static IP address.
You can view the connection region in the Location column of the Connections page.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
Configure the Integration Connectors to assign static IP address for the region
that you got from step 1. Run the following command in your Cloud Shell.
This command returns an operation ID and starts a long-running operation (LRO) which
may take some time to complete. Wait for the LRO to complete. You can track the progress of
the operation by using the following command:
If you want to remove the static IP address configuration for a region, and auto assign the
IP addresses, you must run the following command in your terminal:
Similar to the previous command for configuring static IP addresses, this command also
returns an operation ID and starts a long-running operation (LRO) which may take some time to
complete. Wait for the LRO to complete.
Considerations
Consider the following points when allocating static IP addresses for a region:
The reserved set of static IP addresses are different for different regions within a project.
When you change the egress mode for a region from STATIC_IP to AUTO_IP, the original set of
static IP addresses aren't retained, and therefore, when you again change the egress mode from
AUTO_IP to STATIC_IP, a new set of static IP addresses are allocated.
When you change the egress mode from AUTO_IP to STATIC_IP or the other way around,
you can expect a downtime in the order of seconds.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eIntegration Connectors can connect directly to publicly accessible backend applications by specifying the endpoint in the \u003ccode\u003eHostname\u003c/code\u003e field, allowing direct access.\u003c/p\u003e\n"],["\u003cp\u003eFor restricted access, Integration Connectors can be configured to use static IP addresses, allowing you to allowlist these addresses in your firewall to control traffic.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring static IP addresses for connections involves creating a firewall, assigning static IPs to connections, and then allowlisting these IPs in the firewall, but detailed firewall creation is not included in this page.\u003c/p\u003e\n"],["\u003cp\u003eStatic IP addresses are assigned at the region level, with different regions having distinct sets of static IP addresses, and you can change between \u003ccode\u003eSTATIC_IP\u003c/code\u003e and \u003ccode\u003eAUTO_IP\u003c/code\u003e modes, but it will generate new IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eYou can use provided commands to configure Integration Connectors to use either static or automatic IP addresses for a specific region and get the IP addresses, with changes between modes causing brief downtimes.\u003c/p\u003e\n"]]],[],null,["Public network connectivity\n\nThis page describes how Integration Connectors can connect to your publicly accessible backend applications.\n\nThe following are the two ways to connect to your public backend application:\n\n- Connect to your public backend application directly.\n- Connect to your public backend application through a firewall.\n\nConnect to your public backend application directly\n\nIf you can publicly connect to your backend application, you can\nconfigure your connection to use the\npublic endpoint by specifying the endpoint in the `Hostname`\nfield. Your connections will have direct access to your backend application.\n\nConnect to your public backend application through a firewall\n\nIn cases where you want to restrict access to your public\nendpoints with a firewall, you can configure\nIntegration Connectors to use a set of static IP addresses for\nthe traffic originating from the connections. After the configuration, all calls from a connection would originate from a set of static IP address, which you can allowlist in your firewall. To allow a connection to connect through a firewall, you must do the following high-level steps:\n\n1. Create a firewall, and route your egress traffic through the firewall.\n2. Assign a static IP address to your connection.\n3. Allowlist the assigned static IP address in your firewall.\n\nSteps to create and configure a firewall are outside the scope of this page. This page only describes\nhow you can assign static IP addresses to your connections.\n\nBy default, Integration Connectors allocates IP addresses automatically. However, you can\nconfigure Integration Connectors to generate static IP addresses instead of an automatic\nIP addresses. Integration Connectors assigns the static IP addresses\nat a region level. For example, the static IP addresses for the `us-east1`\nregion will be different from the static IP addresses in the `us-west2` region.\n\nTo assign static IP addresses to your connection, do the following steps:\n\n1. Get the region of the connection for which you want to allocate the static IP address. You can view the connection region in the `Location` column of the Connections page.\n\n [Go to the Connections page](https://console.cloud.google.com/connectors/connections)\n2. In the Google Cloud console, activate Cloud Shell.\n\n [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)\n\n\n At the bottom of the Google Cloud console, a\n [Cloud Shell](/shell/docs/how-cloud-shell-works)\n session starts and displays a command-line prompt. Cloud Shell is a shell environment\n with the Google Cloud CLI\n already installed and with values already set for\n your current project. It can take a few seconds for the session to initialize.\n | **Tip:**Even though this step mentions to open a Cloud Shell, you can run the commands even on your regular terminal, because you will be calling the Integration Connectors public APIs.\n3. Configure the Integration Connectors to assign static IP address for the region that you got from step 1. Run the following command in your Cloud Shell. \n\n ```verilog\n curl -X PATCH -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"networkConfig\": {\"egressMode\": \"static_ip\"}}' \\\n https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/regionalSettings?updateMask=\"networkConfig\"\n ```\n\n Set the \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e to the region that you got in step 1.\n\n Running this command, returns a response similar to the following: \n\n ```\n {\n \"name\": \"projects/test-01/locations/us-central1/operations/operation-1696840994443-6074494b6d138-8215226d-516faaf8\",\n \"metadata\": {\n \"@type\": \"type.googleapis.com/google.cloud.connectors.v1.OperationMetadata\",\n \"createTime\": \"2023-10-09T08:43:14.467058513Z\",\n \"target\": \"projects/test-01/locations/us-central1/regionalSettings\",\n \"verb\": \"update\",\n \"requestedCancellation\": false,\n \"apiVersion\": \"v1\"\n },\n \"done\": false\n }\n ```\n\n This command returns an operation ID and starts a long-running operation (LRO) which\n may take some time to complete. Wait for the LRO to complete. You can track the progress of\n the operation by using the following command: \n\n ```scdoc\n curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n https://connectors.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/operations/OPERATION_ID\n ```\n\n If the static IP address allocation is successful, you will get a response similar to the following: \n\n ```\n ...\n ...\n \"response\": {\n \"@type\": \"type.googleapis.com/google.cloud.connectors.v1.RegionalSettings\",\n \"name\": \"projects/test-01/locations/us-central1/regionalSettings\",\n \"networkConfig\": {\n \"egressMode\": \"STATIC_IP\",\n \"egressIps\": [\n \"35.193.227.203\",\n \"34.133.63.9\",\n \"35.223.253.58\",\n \"34.170.27.253\"\n ]\n }\n }\n ```\n\n In this sample response, four static IP addresses are allocated for the `us-central1`\n region, and the `egressMode` for the region is set to `STATIC_IP`.\n | **Note:**By default, Integration Connectors assigns auto IP addresses for the connections, and not static IP addresses.\n4. Allowlist the static IP addresses (got in step 4) in your firewall rules.\n\nGet static IP addresses of a region\n\nIf at anytime you want to get the static IP addresses allocated to a region (location), run the following command: \n\n```verilog\ncurl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/regionalSettings\n```\n\nRunning this command returns a response similar to the following: \n\n```\n \"response\": {\n \"@type\": \"type.googleapis.com/google.cloud.connectors.v1.RegionalSettings\",\n \"name\": \"projects/test-01/locations/us-central1/regionalSettings\",\n \"networkConfig\": {\n \"egressMode\": \"STATIC_IP\",\n \"egressIps\": [\n \"35.193.227.203\",\n \"34.133.63.9\",\n \"35.223.253.58\",\n \"34.170.27.253\"\n ]\n }\n }\n```\n\nAssign auto IP addresses to a region\n\nIf you want to remove the static IP address configuration for a region, and auto assign the\nIP addresses, you must run the following command in your terminal: \n\n```verilog\ncurl -X PATCH -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"networkConfig\": {\"egressMode\": \"auto_ip\"}}' \\\n https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/regionalSettings?updateMask=\"networkConfig\"\n```\n\nSimilar to the previous command for configuring static IP addresses, this command also\nreturns an operation ID and starts a long-running operation (LRO) which may take some time to\ncomplete. Wait for the LRO to complete.\n\nConsiderations\n\nConsider the following points when allocating static IP addresses for a region:\n\n- The reserved set of static IP addresses are different for different regions within a project.\n- When you change the egress mode for a region from `STATIC_IP` to `AUTO_IP`, the original set of static IP addresses aren't retained, and therefore, when you again change the egress mode from `AUTO_IP` to `STATIC_IP`, a new set of static IP addresses are allocated.\n- When you change the egress mode from `AUTO_IP` to `STATIC_IP` or the other way around, you can expect a downtime in the order of seconds."]]
